Short answer is: the mass of the string and the mass of the excitation of the worldsheet CFT are two different masses.
To elaborate a bit.
The Hilbert space of the string is not the same as the Hilbert space of the CFT due to the presence of constraints.
In fact, string states are parametrized by CFT states with conformal dimensions $h = \bar{h} = 1$. In CFT, states are in 1:1 correspondence with local operators. By taking a local CFT operator $V$, the string operator is constructed from it by taking the integral
$$ \int d^2 z\, V.$$
This integral is Weyl-invariant only if $V$ has conformal weight $(1, 1)$.
The string state space can be obtained from the algebra generated by these integrated operators, for example, via the GNS reconstruction (the algebraic state is given by the integrated VEV of the CFT).
For example, the string tachyon corresponds to the local CFT operator
$$
V(z, \bar{z}) = \; : e^{i P_{\mu} X^{\mu}(z, \bar{z})} :,
$$
with $P^{\mu}$ arbitrary $26$ numbers parametrizing the tachyon (interpreted as components of its momenta).
For this state to be a legit stringy state and not just a state in the CFT, we must have the conformal weights equal to one. It turns out that it is only the case if
$$ P^{\mu} P_{\mu} = - M^2 = \frac{4}{\alpha'} > 0. $$
This gives the (imaginary) mass of the tachyon.
You can say that the origin of the mass of the string is quantum mechanical when we're looking at the corresponding QFT.
This is because classically $X^{\mu}$ has mass dimension $0$ (it is conformally invariant) and hence we expect any function of it such as $e^{i P_{\mu} X^{\mu}}$ to also have mass dimension $0$.
But in the quantum CFT, $e^{i P_{\mu} X^{\mu}}$ is not a well defined operator (it contains an ultraviolet divergence).
If we instead use its normal ordered version, we acquire a nontrivial anomalous mass dimension which depends on $P^{\mu}P_{\mu}$,
and depends on $\hbar$ when the units are restored.
This anomalous mass dimension gives the string its mass.
